Re: 64bit MAC addresses and SLAAC

[Fernando Gont <[e-mail]>]

On 18/6/20 07:13, Philip Homburg wrote:
>>> If a host is connected to a subnet that has multiple prefixes, then using
>>> the same IID for all prefixes only has marginally less privacy than
>>> using different IIDs.
>>
>> Well, it does allow correlation of network activities across addresses.
>> In a way, that's kind of the same as when a host moves across networks.
> 
> My home network has a number of prefixes. From reverse DNS you can easily
> figure out that they are the same. How does it help me to have different IIDs
> for different prefixes?

different-per-prefix IIDs cannot, of course, mitigate information 
leakages that happens elsewhere.

FWIW, I use about 7+ GUA prefixes at home, with no reverse DNS mappings. 
RFC7217 prevents activity correlation  among them. Traditional SLAAC 
IIDs would have made it trivial.


> I'm not saying that anything needs to be changed. Just that we should not
> oversell the privacy benefits.

As noted in many discussions we have had on the topic, ipv6 iid 
"randomization" mitigates correlation at the network level. In your 
particular scenario, the information leakage happens elsewhere.

i.e., if you want to mitigate activity correlation as a whole, doing 
something sensible for ipv6 addresses is one bit of the "puzzle".

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492